escape DB HTML value